Matchmaking firm Duo leak exposed your weight, assets, religion and more

South Korea’s privacy watchdog has fined matchmaking company Duo after hackers stole detailed personal profiles of more than 427,000 paid members, in a breach that exposed information ranging from resident registration numbers to marital history, religion and education records.

The Personal Information Protection Commission said on Thursday that the leak affected all 427,464 paid members after malware infected a Duo employee’s work computer in January last year.

The watchdog imposed a fine of nearly 1.2 billion won ($810,000) and a separate administrative penalty of 13.2 million won.

The attacker then obtained credentials for the company’s database server, accessed the member database and downloaded the records, the commission said.

The stolen data went well beyond basic contact information.

According to the watchdog, it included encrypted passwords and resident registration numbers, as well as names, birth dates, gender, email addresses, mobile phone numbers and home addresses.

The breach also exposed profile details tied to Duo’s matchmaking business, including height, weight, blood type, hobbies, religion, marital history, sibling order, education background and workplace information.

Regulators said Duo had failed to put in place basic protections for its membership database, including measures to restrict access after repeated authentication failures. It also found that the company used insecure encryption algorithms for resident registration numbers and passwords.

The commission additionally said Duo had collected and stored resident registration numbers from paid members without a separate legal basis. The company also failed to delete 298,566 member records even after the five-year retention period stated in its privacy policy had expired.

Duo was found to have delayed reporting the breach beyond the required 72-hour window without valid reason, even after confirming that member data had been leaked.

Duo also failed to notify affected users, despite the risk of secondary harm from the exposure of such detailed personal information.

The watchdog also ordered Duo to immediately notify affected members of the leak, strengthen safeguards to prevent a repeat incident, review whether it is collecting only the minimum data needed to provide its service, establish clearer data destruction rules and improve its overall data protection system.

The commission further ordered the company to disclose the sanctions on its website.